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1981 ACTIVITY MPORT 


AEROSPACE SAFETY ADVISORY PANEL 


I. Ex«cuttv Suawry 

In 1981 » the first two Shuttle flights «»srs secosplishsd and 
ths Asrospscs Safety Advisory Panel (ASAP) logically concentrated 
on the process of preparation for flight and the gathering of 
inforaiation from these flights to confirm the concept and 
performance of the s«jor elements of the Space Transportation 
System. In this year's activities it became obvious to the Panel 
that the safety of the Shuttle operation %rould be increasingly 
dependent on (1) the procedures for turnaround* (2) the ability to 
quickly assess system performance from flight expe**ience* (3) the 
developing judgment concerning what needed to be rechecked for 
each operation* and (4) the astute creation of truly "operational* 
procedures which would be simple enough to realise cost saving and 
thorough enough to maintain safe and reliable operations. 

Following this line of reasoning* the ASAP has reviewed its 
membership* has revised it to amplify operational know-how* and 
has turned its attention to the operational plans that NASA is 
developing and the organisation concepts that will be used in 
fulfilling those plans. 

In tne current budget environment* it is recognised that many 
of the significant system changes previously suggested by the ASAP 
and those recommended in this report will not be feasible for 
retrofit in the present Orbiter production series. As a direct 
result* a number of the present systems will require more 
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continuin9 special raadlntas attention than raviaad syataas 
dasignad to ba optiatua for routine operation. Under theae 
limiting circuattances the AShP conaiders that the eatiaated 24 
flights per year with 4 Orbiters will be very difficult to 
achieve, Having to use the hardware currently available should 
not prevent planning for an orderly MD and certification program 
to create aore nearly optiaum operational systeas. Such systeas 
will then be available for incorporation in future Orbiters or for 
retrofit in the event that other factors, such as a demand for 
major performance improvements, dictate an extensive change 
program. 

In reviewing the "incidents” which have occurred during STS-1 
and STS>2 flights, it is apparent that the R&D nature of these 
first efforts, along with the reliance on complex paper systems 
for documenting the check and balance functions, have nearly 
obscured the necessity for personal, ”on the floor,” 
responsibility of supervision at all levels for safety and 
success. Many details of doubtful importance are raised to the 
highest management levels for decision by-passing the judgment of 
middle management and clouding the truly important issues that 
should be defined for major management decisions. The Safety 
Assessment Report, the Accepted Risk Summary, and the Critical 
Issues procedures as made available to the ASAP are examples of 
systems that should be reexamined for simplification and 
reorientation to identify the issues that truly need top 
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«anag«ii«nt attantion. In this proeass siMplifiad turnaround 
procaduras should auarga* along with tightar disciplina to assura 
properly schadulad avants and avoid last uinuta improvisations 
which can introduce hidden hazards. 

The concept of the transportation system itself » including the 
essential subsystems » should also be raviatfad for operational 
simplicity along with the management and procaduras. The ASAP has 
attempted to review the basic architecture of the essential 
subsystems and recognizes that, in a number of cases, the 
state-of-the-art in modern transports and military aircraft offers 
opportunities for improving the safety and reliability of Shuttle 
systems based on mature concepts that have been operationally 
proven. Specifically, the ASAP recommends a major audit of the 
concept of redundant systems as applied to the essential elements 
of the Shuttle. The Panel believes that a more consistent 
approach to redundancy throughout all systems will simplify the 
elements and reduce costs while enhancing safety. The Panel 
recognizes that changes of any kind mu*t await schedule and budget 
"windows" but suggests that an orderly subsystem improvement 
program can reduce ultimate costs and improve turnaround time. 

Previous advice to NASA on turnaround procedures implied 
changes in organizational functions within NASA. The ASAP has 
suggested that a purely operational organization should be created 
that would function like an airline or a military mission command 
as compared to an engineering and development organization. Such 
an operational entity would relieve the RfcD organization of 
responsibilities it is ill-equipped to handle and would improve 
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th« MD function Itsolf by stnbUisin9 tho porfornanco 
raquirananta and by davaloptn; futura euttoaars to justify 
continuing davalopnant prograns* l^a oparational organisation# it 
is auggastad# should purchaaa aarvicas and hardwara fron tha 
davaloj^ent part of NASA much as an airlina purchaaas its 
transport aircraft# spares# technical support# and early training 
from tha aircraft manufacturer. 
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II. STS-1 and STS-2 Turnaround Proc»«s and i««t Op»ftion« 

As could b* cxpectodf th« turnaround of 6T8-1 and ST6-2 had 
to be nodi fled to accommodate the performance of major subsystems 
and the condition of these systems. As the Panel has reviewed 
these activities it is obvious that the preparation* and the basic 
design* produced a near miracle in functional success. The 
systems representing the most ambitious penetration of the 
state>of>the>art« the main engines and the thermal protection 
system* performed almost perfectly. Similarly the control and 
attitude* primary instrumentation* and boost propulsion units all 
functioned as required. This remarkable performance must not be 
forgotten in reviewing potential improvements in the turnaround 
process — it suggests that a number of present subsystems will 
readily demonstrate "operational status" and permits relaxation of 
"every flight" test and check requirements. 

The Panel's annual report for 1980* in the section on NASA 
Review System* discussed the Panel's generally positive 
conclusions regarding the commitment of top management to achieve 
an acceptable level of risk prior to authorizing the first manned 
Orbital flight of the Space Shuttle. We can reaffirm these 
conclusions in the present annual report. Panel members 
participated in all major program and flight readiness reviews 
prior to STS>1 and STS-2. Concerns reported by the Panel to top 
management* such as Orbiter entry stability and control* Orbiter 
seat eject system* S?B overpressure* timely recovery of the crew 
after landing* STS>2 launch schedule* and flight control analysis 
of off-nominal conditions* were carefully examined and documented 
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reports %r*r* sad* to tha Panal. nia naw NASA oianagaaant taan» 
from tha Administrator on down* raaffirmad thair pradaeassors* 
commitment to achieving an acceptable level of risk prior to tha 
flight of STS-2. 

Apparent in tha preparation and turnaround was tha 
predominant control of tha process by tha development 
practitioners of NASA and the understandable lack of patterns and 
experiments to reduce turnaround time and cost. Of particular 
concern to the ASAP was the apparent lack of "floor 
responsibility* at KSC. The Panel believes that the hypergolic 
propellant spill incidents demonstrate poor local supervision of 
specific procedures and a vague line of authority for essential 
tasks. Other evidence of poor discipline were instances of 
Shuttle damage by ground gear not clear of moving surfaces and 
ineffective access control of Shuttle areas not habitable due to 
the suspected presence of gases. The Panel recognizes the 
complexity of controlling a mix of personnel from other centers, 
many contractors, and base personnel, not to mention multiple 
advisors. The Panel also recognizes that written procedures by 
themselves can never substitute for capable *on the floor" 
supervision adhering to such procedures. Operations management 
must be in charge to make the total process successful. NASA 
organization responsibilities clear to the top need to be 
re-identified before simplification of the turnaround is achieved. 

Of particular concern to the Panel from a design and system 
standpoint is the practice of m. jor reprogramming between flights. 
For normal transport operations the essential content of the 
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airborn* and ground support cosputsr sssorlss should rsnsin 
untouchod fros flight to flight* liniting rsprogrsaning to that 
nscossitstsd by ths psrticulr cargo being carried. Even this 
reprogramming should be approached on the basis that there will be 
common functions for all payloads that can be accommodated without 
mission to mission reprogramming except for constants or I*Loads. 
A. Readiness Review Process 

The ASAP believes that the readiness process needs to be 
reconstituted before it is effective for operations. 

To the Panel it appears that: 

1. Reliability* safety* and quality organizations should 
be more clearly in the decision loops and the 
documentation process appears to be used more for 
post operation justification of actions than for 
deciding on readiness. 

2. The documentation used for summarizing risk and 
evaluation of readiness as represented by the safety 
assessment report* the accepted risk summary* and the 
critical issues summary all appear to be dedicated to 
listing every possible concern so that retrospective 
examination will find no basis for criticizing 
thoroughness. These procedural activities did not 
appear to represent a management level by level 
evaluation of risks and a summary of judgmental total 
risk truly suitable for use by higher management. 

3. The inherent assurance of having a separate 
operations team independently assess readiness* 
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•s is the ease with established transportation 
systems may not function adequately with NASA's 
present structure to assure an independent readiness 

opinion. Historicallyf management of the Space 

% 

Transportation System has developed a pattern whereby 
Headquarters balances input from the "program,* the 
centers, and the test community. Thus, no one 
organization within NASA has full responsibility for 
operations decisions. This must be modified before a 
routine and reliable operations function can achieve 
success. 

B. Technical Audit Process 

Among the many successes of STS-1 and STS-2 was a technical 
audit initiated at Houston to review and supplement the more 
routine sneak circuit analyses. This ad hoc function did not use 
"independent" evaluators or professional safety or quality 
assurance practitioners. It utilized the design team members who 
were responsible for major elements of the Shuttle systems and 
therefore had familiarity with the fundamentals of the systems and 
their limitations. They were also familiar with the test 
successes and failures and the interface functions among the 
elements. 

The success of the ad hoc technical audit suggests that the 
process should be expanded in support of future Shuttle concept 
changes and improvement programs, it should also be considered by 
any new operations organization to assess routine processes and 
piocedures and suggest new approaches which could save costs 


8 



without inertatlng hazards. Tha ASAP bal lavas that tha succass of 
such ad hoc taams stams from tha eurraney of thair tachnieal or 
operational axparlanea, thair total familiarity with tha system 
and their lack of dedication to any routine reporting or 
documentation discipline. 

C. Orbiter Performance and Control Margins 

The R&D program of four flights may be adequate to assess the 
safe operation of the system, but routine efficient operations 
require knowledge of the boundaries of performance that may not be 
fully established within the planned R(D effort. A plan needs to 
be established for continued performance envelope expansion to 
improve operational utility. Examples of the limitations include, 
c.g. limits for re-entry control, launch tower clearance for broad 
weather variables, and a myriad of redline limits which must be 
cleared before launch. 

The Panel is particularly concerned with the demonstrated 
ambivalence to "redline" limitations. Redline limits should be 
set, and presumably have been, by combining accumulated experience 
of both design and safety engineers. To override such judgment in 
the readiness and launch environment potentially introduces 
unevaluated risks. This should be avoided in any cas and must be 
for any operational mode. The Panel conclusion from this 
experience is that "redlines* should be reassessed -- this may be 
a task for an ad hoe technical audit team. This could remove 
unjustified conservatism and could provide a rational basis for 
the rigid "redline" discipline which must be achieved. 
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III. M«w Function Empha«l« for Transport Syfm« 

Th« d«v«lopmtnt of th« Shuttlo was a MSKiva rasaarch and 
davalopman'c task dona by or undar tha diraetion of NASA's 
davalopmant'oriantad centers. This was appropriate and 
successful. The task after the remaining development flights is 
to operate the present system in as economic and routine a manner 
as is possible. In addition, it is necessary to gain information 
that will create requirements for progressive improvements ^r 
needs that will become the basis for future new systems. 

To achieve routine operation, the Panel believes that the 
Shuttle must be operated by a separate organization, with 
facilities dedicated to transportation services alone. Much like 
an airline or a military operational base, this organization 
should have no research and development charter nor capability but 
should be staffed by an experienced cadre of operational people. 
Although there are many capable "test” people in NASA the ultimate 
success of the transport system probably depends on NASA's ability 
to attract new people both in house and via contract. A clearly 
separate operations organization will be helpful in recruiting 
such talent. 

Properly constituted and manned, such a transport 
organization would have the capability to: 

o Assess hardware performance on the basis of operational 
reliability, reusability and low cost, 
o Emphasize logistics planning, including spares. 
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o Assess changes on a cost and reliability basis rather 
than on performance improvement alone and control these 
changes. 

0 Base operations planning only on payload need thereby 
producing reliable schedules, and an operations budget 
plan that reflects cost savi* ^s due to learning, 
o Create requirements for future performance improvements 
based on "market* needs — for NASA itself as a customer, 
commercial programs, and the military, 
o Stabilize the rate of technical change, simplify 

procedures, and reduce the traffic of decision demand 
upon Headquarters, 
o Develop future customers. 

A. Subcontra c t Services Required by "Space Transportation" from 
the R&D Organizations 

It would be naive to think that the Shuttle and its operation 
would not require subst tial continuing research and development 
as experi<. 'oe generates e'.ther new demands or desirable 
improvements from a cost or safety point of view. To accomplish 
this the operational organization must have a formal channel, and 
be required, to call upon NASA's research and develo^ent elements 
for the necessary work on essentially a subcontract basis. This 
will assure that the proper people do the work and that an 
appropriate framework for financial control is maintained and 
monitored. A few examples of the activities or functions that the 
operational organization should obtain from the research and 
development elements of NASA are: 
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1. The creation of any new Shuttle tranaportation eleaents, 
the requireoents for which should be defined by the 
operations organisation based on transportation custoner 
needs. 

2. The engineering required for changes to iaprove 
reliability, safety, cost or perforaance, the requirenents 
for which are similarly originated and defined by the 
operational organization. 

3. System and component testing services, including the 
certification of new or changed components or systems. 

4. The advisory support of development specialists on a 
consulting basis. 

5. The establishment of a formal program for the continuing 
performance audit of flight and ground systems, including 
tracking, communications and data systems. 

B. Space Transportation Services Provided to RtD Elements of NASA 

The Panel suggestion that the operational Space Transportation 
System look to the scientists and engineers elsewhere in NASA for 
research and development is coupled with a similar recommendation 
that the R(D community of NASA look to the transportation service 
organization for the performance of transportation and operations 
tasks for all of NASA. This on a "subcontract” basis in order to 
Implement a framework for monitoring functional, financial, and 
schedule performance. A few examples of these services are .^ruund 
in the operation of OSTS (Office of Space Transportation Systems) 
today and include further: 
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1. The transport* or orbital placenent* of payloads. 

2. The orbital repair or retrieval of payloads. 

3. The eventual Aaintenanee of orbital facilities for Banned 
or unmanned experiments. 

4. Data delivery from orbital experiments for analysis by 
those responsible for t-he experiments. 

5. Launch services and appropriate support for non-Shuttle 
systems. 

C. k Framework for Successful Routine Operations 

Last year's report by the ASAP commented upon the need for 
expanding its attention to the entire subject of logistics* 
payloads* and operations. These subjects* until the completion of 
two successful launches* have been transcended by the pressures of 
the research and development demands. With the production 
lead-times characteristic of small-batch highly specialized 
products a study which will lead to investment ranging from space 
engines and airframe components to the multitudinous system and 
accessary components is probably already overdue. The Panel is 
directing its attention to this operational phase and can be 
pected to require access to activities and developing programs 
in which its experience and expertise should be of value. The 
Panel looks forward to full cooperation from cognizant 
organization. 

Maintenance and overhaul plans must first be developed in 
detail for KSC and VAFB and then* using these* such logistics 
elements as supply* manning* training* publications* and vehicle 
standardization can more logically fall into place. A range of 
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turnaround ratts ahould ba eenaidartd from tha moat optimiatic to 
tha paaaimiatie, tha lattar eonaidarin 9 tha.poatibla 9 roundln 9 of 
ona vahiela dua to aecidantal damaga or modification. Tha ground 
aupport aquipmant and raquiramanta hava no parallal in pravioua 
practiea and mattars affacting ovarhaul and in-sarviea lifa 
arising from rapaatad launch dagradation ara in naad of apaeial 
study now. Until this most cooprahansiva planning is undartakan 
it will ba difficult to maintain budgetary control in a program 
which has now to ba vary cost-conscious. Schadula raliability is 
the sine qua non to attract commercial and even military payloads 
and, in the view of soma Panel members, is more likely to ba 
affected around 1983-85 by parts shortages than by aquipmant or 
design fail ires. 

In attempting to assess its own capabilities to review future 
Space Transportation Operations the ASAP produced a broad outline 
of functions that must somehow be fulfilled by a truly operational 
organization. Although many of these needs have no direct impact 
on safety they do have an impact on the routine nature of any 
transport system, and therefore a secondary but important impact 
on the recognition of hazards. At tha rates of tha orbital 
missions now planned, it will be absolutely essential that 
procedures stay consistent, changes ba reduced to near zero, and 
that tha launch teams be experienced, well trained, and have 
qualified spares at hand. 

D. Prime Functions of Transport Operations 

1 , Planning and marketing 

a. Planning for present market 

U 




b. Putur* payload and orbit naada (coaaiarcat 
9ovarraiant» ailitary) 

c. Total traffic projaction 

d. Sarvica cost projaction 

a. Sarvica pricing policy raconnandations 

f. Sailing of sarvicas 

2. Enginaerinq and oparations 

a. Dafinition of product improvanant naads 

b. Facility Planning 

c. Logistics plans and oparations 

d. Support and procuramant (sparas, fluids, 
sarvicas) 

a. Schaduling 

f. Ovarhaul and maintananca 

g. Base operations (launch and landing) support 

h. Quality assurance 

i. Cost control of transport system services 

j. Payload sarvicas to customers 

k. Training 

3. Tracking, communications and data sarvicas 
a. Routine support of oparations 

b* Payload communications and customer data sarvica 

c. System and data base, modernization requirements 

d. Cost control of track, communication, data 
services 

a. Training 


15 


XV. Continuing Activlti»« of tht Mro»p«c» 8«g»ty Advtsotv »n>l 
A. Ponol Moaborshlp 

As notod In tho oxocutlvo sumaryf Panol MMborship to 
provide operational experience has been augaented by aeabers: 

John P. McDonald* Vice President Technical Services of 
ric<erAlr* Inc.* the parent corporation for Plying Tigers. John P. 
McDonald served for a manber of years as vice President of 
Naiitenarce and Engineering* and as a director for the Plying 
Tl<;sr Line. Previous to that* he directed all coimerclal 
customer support activities for the Lockheed California Company. 
He was educated as a mechanical engineer In England and served 
British Overseas Airways Corporation before coming to America. 

Norman R. Parmet* recently retired Vice President of 
i^ngineering and Quality Assurance for TransWorld Airlines. Norm 
?armet has served TWA since 1947 in a number of roles including 
^^owe** plant development and as Vice President for New Equipment 
Development, as well as Logistics Nanagenent. He was graduated as 
a mechanical engineer from Drexel Institute of Technology. 

Plans for 1982 include a replacement for Dr. Seymour C. 
Himmel* whose term of appointment as a member was completed In 
1981, and ha. been retained as a consultant for one year. It is 
hoped t; t his replacement will bring to the Panel similar 
expe'^tise in the power plant field* particularly In hypergolic 
eystc^ms which now appear to require concentrated attention. 

During the y*‘ar* it is also hoped that the Panel can be augmented 
by experience in the architecture of modern control systems. 
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B. infor— 1 Subgroup Actlviti»« 

It is sxpsctsd that inferMl subgroups of tho Psnol trill bo 
fornod to follow cortoin spocific sctivitios. In tho viow of ASAP 
tho following oppoor to bo psrtieulsrly isiportsntt 

1. An assossont of any continuing tochnicsl audit 
function instituted by tho R&D progrra nanagonont. 

Such concontratod tochnical assossnont was 
responsiblo for uncovering sneak circuit hazards 
prior to STS-2* and should bo continued seeking 
improvements in safety and reliability for the 
electrical » electronic, and computational systems. 

2. Suggested in this report is an audit of the systems 
redundancy concepts for the many Shuttle subsystems. 

The Panel believes that major simplification is 
possible which could benefit cost, performance, and 
safety. If alternative concepts cannot be 
accommodated within budget and schedule constraints, 
they can be incorporated in subsequent block buys of 
improved transportation systems and should be 
initiated now. 

3. If NASA reorganizes to include an independent 
"operations” entity, a safety audit team should 
review the transition of procedures from RtD to 
operations. The criticality of this transition and 
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tht obvious ntod for r.sstivt proeoduros 
sinplifiestion suggtst thst • continuing oudit will 
bt rtquirod. Tht hShP will osstss this setivity or 
its oquivsltnt. 

C. Plans for 1982 

Tht Pantl hat optrattd in tht nodt of fact finding by 
individual ntmbtrs or small informal groups visiting tht 
appropriatt ctnttrs and contractors. During tht ytar tht Pantl 
comparts notts and communicates with top NASA managtmtnt. It it 
tht Pantl *s intention to continue in this fashionf probably with 
an increased number of times when tht entire Pantl participates in 
the readiness activities prior to STS-3*-4f-5f and -€. It is 
planned to follow Orbiter 099 and particularly note tht impact on 
operational procedures with two Orbiters being readied for launch 
in parallel. 

The actual dates and locations of Panel fact-findings arc to 
be keyed to the Shuttle major milestones recognizing the increased 
activity planned for Shuttle payloads with accompanying hardware 
and software impacts. Payloads include OSSA-1, Spacelab, Tracking 
a Data Relay Satellite System (TDRSS) > and the probable 
incorporation of the Manned Maneuvering Unit (MNU) . In addition 
to such payloads it is expected that the Panel will review 
concepts for upper stage propulsion systems and any early proposal 
for basic Shuttle performance improvements such as light weight 
SRB's or a light weight Expendable Tank. 
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KSC intends to hsvo • self-suCf ieisnt Shuttls Processing 
Contractor when the Space Shuttle becomes operational. It is of 
interest to the Panel that such a transition take place without 
any loss of emphasis on ground and flight safety. 

Although the Panel's efforts directed at programs other than 
the Space Transportation System require less concentrated 
attention they are equally important from the viewpoint of NASA's 
public accountability regarding their safety. In creating the 
Panel, Congress clearly envisioned this broader responsibility. 
These areas include aeronautics programs (manned and unmanned) , 
unmanned space vehicles, and tracking and data acquisition as it 
affects safe mission operation. In times of great budget 
stringency, such as the present, it is especially important that 
safety considerations not be permitted to erode as program 
managers stretch their highly-constrained program resources to 
achieve desired objectives. 

The following is a sample of those areas that are of 
continuing concern to the Panel: 

1. Other Flight Operations : The concentration on the 

early Shuttle flights has diverted the Panel's 
attention from flight operations at Ames, Dryden, and 
Langley. Past Panel experience has shown that NASA 
controls the safety of test operations most carefully 
at these centers and the record shows good 
performance. Several accidents involving flight in 
aircraft not operating under strict NASA test control 
suggest that reviews should be made of procedures 
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wh«r«by NASA p«rsonn«l ar* axpoaad to haaard in lass 
than controlled test conditions. The Panel plans to 
assess policies at these centers and review the 
control cf such activities. 

2. Pressure System Recertification : It has been 

suggested that the ASAP review how NASA certifies the 
pressure vessels and systems at its many facilities 
and how it maintains such certification, ibe Panel 
believes that its primary purpose is to concentrate 
on the safety aspects of manned flight and on the 
safety implications of operating unmanned systems 
rather than on what is normally called industrial 
safety. It is the Panel's assumption that industrial 
safety is a center function which has been 
successfully fulfilled through the years and will not 
address this important subject unless instructed to 
do so by the Administrator. 

3. Contracting Out : Budget pressures and the efforts to 

provide more flexibility in manpower levels as 
operational efficiencies are achieved suggest that 
many more program operations be placed under 
contract. This does not relieve NASA of the 
supervisory responsibility. The inadequate 
compensation schedule of the Federal Government for 
top level managers makes it increasingly difficult to 
maintain a management team of highest technical and 
managerial competence. The exodus of key NASA 
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ptrs'^nntl during th* pat. yaar providaa atriking 
confirmation of this grave problem. Although the 
Administration and Congress recently collaborated in 
achieving a small increase in the Federal pay cap, 
the problem is still unresolved and likely to remain 
so under present extreme budgetary pressures. The 
Panel believes it is essential to point out that 
loyalty and dedication to NASA — a hallmark of the 
Nation's space program to date -- can only go so far 
in substituting for a pay schedule that is truly 
competitive with private industry. In this 
environment it is essential that contractors be 
chosen who can bring the maximum experience to the 
program. 

4. Hydrogen Safety Standard ; The Panel suggestion of a 
future hydrogen-oxygen auxiliary power system and the 
use of this fuel combination for on-Orbit reaction 
control systems imply different safety standards than 
are currently used for the fuel cells. In addition, 
the possible use of the Centaur as an upper stage in 
the Orbiter and the emerging potential of LH^ ss an 
aircraft fuel all indicate that the Panel should 
review existing safety standards for handling 
hydrogen in flight vehicles and in ground facilities 
for storage and service. The Panel will initiate such 
a review. 
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5. MASA»Atr Forc» Coordlnatton t ASAP aetlvitiM h«v« 
not includod any rtviawt of Air Porco launch 
facilitias or ainulation activitiaa. Much could ba 
laarnad from naw approaehas and it ia aaaumad that 
NASA is fully familiar with Air Porca aetivitias. 
Tha ASAP will raly on instructions from tha 
Administrator bafora making any raquasts to tha Air 
Forca for information* 
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V. 8y»ttm A«tt»»mtnt and Hardwart Conctpf to Improve 

Optratlnq Saftty »nd PTforwnc* 

Tht two tucctssful flights of tht Columbia havt damonstrattd 
that tht Shuttle can perform as a space launch vehicle and that 
the Orbiter can be reused — an outstanding technological 
achievement. Even the most enthusiastic proponent of the Shuttle 
would not, however, claim that its present design can achieve the 
level of operational reliability (and hence safety) required for 
economical and "routine* transportation to and from space. There 
are Shuttle subsystems and components that, although acceptable 
for use during a flight test program and early transiton to 
operations, are not optimum for routine operational use. Even 
though the flight test program has just begun, it is 
optimistically planned to be nearly complete with only tero more 
flights. It is not too soon to begin the process of study, 
analysis, design, and planning to improve the operating safety, 
cost, and performance of the Shuttle by reassessing it essential 
elements. 

h two-part effort is required to achieve the improvements 
desired. The first part is a systems-engineering effort — a 
reexamination of the consistency with which systems design 
princioles have been used. The second part will necessarily 
rddress new designs or design modifications of specific hardware 
to achieve simplification, improved safety, and enhanced 
performance. 
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A. Redundancy Rtvl»w 

The Shuttle employs redundancy in its systems to achieve high 
reliability aud thus safety. The degree of redundancy employed* 
however* varies from subsystem to subsystem. For example* in the 
flight control system the main computers are quadruple-redundant 
with a backup computer (and software) and a spare computer that 
the crew can install. The hydraulic system that provides the 
power to move the Orbiter flight control surfaces is 
triple-redundant in pumps and hydrazine-fueled turbines* is not 
redundant for each main engine control and it is double-r^ciundant 
for each Solid Rocket Booster. The hydraulic actuators that move 
the surfaces are simplex with duplex servo-valves. The main 
engine thrust controllers have dual computers and a "lock-up* 
feature in the propellant valve system designed to retain thrust 
level in the event of a total controller failure. 

Similar diversity in the use of redundancy exists in other 
vehicle systems. This raises the question of whether safety 
concepts have been employed in a consistent manner in the Shuttle 
systems design. 

It would be advisable* therefore* to establish an "audit" team 
of experienced R&D systems-engineers to review the design of 
Shuttle systems to ascertain whether consistent safety/reliability 
concepts and criteria have been employed in the design. Where 
such consistency does not exist* the team should recommend design 
changes to provide such uniformity. At a minimum* this team should 
review the following: 
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o 


Hydraulic po%rer syataait 
o Flight control aystan architactura 
o Main angina thrust control aystaa 
o Main and backup compitar systams (including 
programming) 

0 Electric power system (including fuel calls) 
o fommunication and data systam& 

B. Specific Systams 

Th^ra are a number of systams which can be improved by 
redesign or design modification. The panel believes that: the 
following systems deserve attention in approximately the order 
listed. 

1. Landing gear ; At present the margin of safety of the 
gear for the originally-established design conditions is 
low. In addition* the design is such that should a tire 
fail, its mate (almost certainly) would also fail — a 
potential hazard. Redesign of the gear incorporating a 
larger nurnt of wheels than the current configuration 
would improve both the load-carrying capacity and enhance 
the operational safety of the system. Experience has 
shown that debris from the wheel ground interface has 
damaged the thermally-protected Shuttle surface. In any 
redesign, an effort shoul'^ be made to divert such debris 
away from contact with the Shuttle — spray ribs on the 
tires might be helpfi*!. 
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2. Solid Rockot BoostTs ; At pr*s«nt« th* giaballod 8RB 
nozzlos provide part of the control authority during 
ascent. Each SRB is equipped with a pair of hydraulic 
power units for the giabal actuators. These 
hydrazine-fueled turbopump systems are complex and heavy. 
It was prudent to provide this control capacity for the 
early flights as it is not possible to predict with 
suitaole accuracy the control moments required during 
ascent in the absence of flight data for the unique 
configuration of the Shuttle. Now that flight data are 
becoming avail able » this system should be examined 
carefully to determine whether all the control authority 
provided is necessary or whether the SSHEs alone can 
provide all that is needed. In the latter event* the SRB 
auxiliary power units could be eliminated and relatively 
slow-acting electric actuators substituted to provide a 
programmed pitch profile during boost as the center of 
gravity changes. The savings in weight* complexity* and 
safety should be significant. 

Additional performance improvement might be obtained by 
employing a composite material for the SRM case instead 
of the metal now used. This possibility should be 
studied thoroughly. Finally* the booster recovery system 
should be reexamined to see if it cannot be made 
substantially more simp than it is now. 
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3. Cockpit and Cfw Sf tion Dftqnt Tho crow hos ayrlod 
dutios to porforo in tho cockpit. Tho workleod con* ot 
tioot, opprooeh tho ooturotion point. During STS-2t tho 
crow tforklood* oggrovotod by sonsor onoMlIot ond tho 
fuol coll problon, bocono so hoovy thot tho crow foil o 
couplo of hours bohind in tho *Crow Activity Schodulo.* 
Tho nany sensor and transducer indications of *rodlino* 
approach or ponotrationt thoraostat aalfunctionSt otc., 
raise tho question of whether tho qualif icotion ond 
certification for such instruaentaton is adequate. A 
thorough acrubdown of tho cockpit displays* controls ( 
switches* and the reliability of the sensors furnishing 
the information is indicated. In addition to assuring 
that the crew is furnished needed and valid data it is 
probable that a combination of automation and 
simplification would make Shuttle flight an easier task 
for the crew and thus safer. 

During discussions with the flight crew of STS-1 concern 
was noted over the design of the emergency egress systems 
after flight STS-4 when the ejection seats are scheduled 
to be removed. The entire Panel did inspect the mockups 
available at JSC and concurs with the crew comments that 
an important safety concern exists. Of particular import 
is crew egress after ditching. The Panel heard an 
outline for future study at JSC and reviewed what was 
known of previous tests. It appeared to the Panel that 
substantially more effort to determine likely scenarios 
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and thair eonsaquaneaa is in ordar. Although ditching 
•ay ba axtraaaly raaeta this dots not raliava NASA of tha 
rasponsibility to provida tha craw with as groat a ehanca 
to surviva as possibla. 

SIP Matarial I»prova«ant ; Ona of tha problaas of tha 
Orbitar tharnal protaction systaa is tha hystarasis in 
tha stress-strain relationship in tha strain isolation 
pad (SIP) aatarial. A new version of tha aatarial with 
organized fiber orientation and consistent adhesion to 
the structure and the tile, rather than tha random 
orientation of fibers in the present aatarial, offers tha 
promise of substantially reduced, if not eliminated, 
hysteresis. This development should be pursued actively. 

5. Flight Control : At present, each control surface of the 

Orbiter is a single structure driven by a single 
actuator. Such simplex configurations are undesirable 
and are avoided in modern transport and military 
aircraft. Two alternative configurations have been 
employed in transport aircraft. The first is to employ a 
set of smaller independent control surfaces and actuators 
in place of a single large surface and actuator. The 
second is to use multiple actuators in parallel or in 
tandem on a single surface. Either approach enhances 
operational reliability and safety and these should be 
studied for possible incorporation in the operational 
Shuttle design. The Orbiter shares the problem of 
directional instability at high mach numbers with most 
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•od«rn sap«rsonie fighters due to the vertleel tell 
being blinked by the shock «isveo esineting on the fciusrd 
surfaces of the vehicle, this has resulted in changes in 
the cosputer handling of the reentry maneuvers and the 
use of yaw thrusters nearly down to Nach 1. Since a more 
direct reference systen has already been designed and 
qualified it tfould seeai prudent to utilise this Shuttle 
Entry Air Data Systen (SCADS) to deternine whether such a 
reference «iould help to produce SM>re stable reentries and 
reduce the denand on use of yaw jets at low nach nunber. 

6* Coronon Non~Hyperqolic Propellants ; Other than for the 
nain propulsion and booster system • the Shuttle enploys 
hypergolic propellants for auxiliary propulsion and power 
generation. Hydrazine and Nitrogen-Tetroxide are the 
propellants employed for these purposes. Both are toxic* 
incompatible with many Orbiter mterials with which they 
may come into contact inadvertently* and are difficult to 
handle. None of these attributes are conducive to 
"routine" use and continuing problems involving safety 
and schedule can be expected. During both STS-1 and 
STS-2 preparation and turnaround* tl^e presence of such 
naterials limited access to the Shuttle* and during 
preparations for STS>2 there were ttio incidents involving 
spills of these propellants. Both these incidents and 
the lack of access impacted the preparation schedule for 
the Orbiter. 
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It would bo odvant090ous iC tho uto of thoso propollonts 
could bo ovoidod. Tho propollonts for tho SSNEs» hydro 9 on 
and oxy9on, alboit cryogonics* could bo usod for tho 
Orbital Nanouvoring Systoa (ONS) , Roactlon Control 
Syston (PCS) t *nd PPU systows without wany of tho 
operational probloms oC ) hyporgolics. There have boon 
significant advances in tho technology of hydrogen auJl 
oxygon for ancillary systems applications since tho 
decisions wore made to use hyporgolics in tho Orbitor 
a decade ago. K serious review of tho possible use of 
H2 and O2 should bo made. 

The recommended studios and redesigns should bo 
established as an overall program for the improvement of 
the Shuttle and its further development as an operational 
transportation system. The Panel fully recognizes the 
budget and schedule pressures that inhibit incorporation 
of changes even if many advantages accrue. The Panel 
also recognizes the hazard of change itself and its 
impact on procedures and the performance of even 
well-trained personnel and supervision. Thus» the 
concepts suggested are only for the purpose of indicating 
areas of attention for any planned improvement program or 
for defining the configuration for a future block 
purchase of an advanced transportation system. 
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VI* Conclusions 

Tht Asrospset Ssftty Advisory Psntl eowMnds snd eengrstulstss 
all of NASA snd its contractors for tht historic flights ST8«1 and 
8TS-2* A task that vtrgtd on tht lapossiblt has bttn accoaplishtd 
with the world privileged to watch every step* The success of 
these aissions teapers any suggestions for iaproveaent but* 
iapressive as the development has been* the aim of the program is 
routine operation * In this spirit the ASAP offers these 
suggestions based on its evaluation through 1981* 

A. To achieve true operating safety* regularity* and ainiaum 
practical cost* the organisation of efforts between the RtD 
community and any transportation service organization should 
be clearly separated . The transportation service 
organization should assume responsibilities analagous to 
commercial airline managements. This includes marketing of 
its services to government agencies* and to commercial as 
well as international entities needing space transportation* 
Implied in "operations* is the planning and acquisition of 
prime hardware and spares* maintenance* certification of 
procedures* training* creation of requirements for future 
development including performance improvement and the 
responsibility to determine readiness for all missions and 
the fulfillment of these missions safely. 

B. The Panel suggests a technical audit of the application 
of redundancy concepts to Shuttle systems* From design 
reviews the ASAP believes that many systems can be simplified 
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with both Mftty and cost bantfitt whila othar ayttaaia shoald 
ba bachad up furthar Cor eparational aafaty. hBKP eandidataa 
for auch a ravlaw arat 

1. Total hydraulic powar ayataa — both Cor aolid 
roekat and Shuttla control — including tha uaa* 
numbarSf configuration and location of auxiliary 
powar plants. 

2. Basic control systaa architactura Cor aarodynamic 
controls, aain anginas, SRBs, and Orbitar control 
motors. 

3. Control of main angina thrust. 

4. Computar logic in normal and backup modas with a 
spacial affort to standardisa programming Cor 
oparations to pravant flight-to*Clight and 
particularly last minuta raprog ramming. 

5. Elactric powar systams 

€. Avionics and communication 
C. Tha currant davalopmant stata of tha spaca 
transportation hardwara suggasts that a numbar of 
eoncapt changas may improva operational safety, 
reliability and costs. In priority, tha ASAP suggest: 

1. Investigating a main landing gear with more than t«ra 
wheals per side and devices to avoid gravel "spray* 
which damages thermal protection tiles. 

2. Reviewing tha need for control of SRB noxzles to 
maneuver the total Shuttle vehicle. As performonca 
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of the control eysten evolves, it My be possible to 
revert to s prograsmed "tria* systen on 8RBs« In 
addition, when investigating lighter eases 
(composites) the separation and recovery systems 
should be reanalyzed to simplify. 

3. The automation and simplification of cockpit and 
routine crew duties, along with improved reliability 
of sensors. 

4. Review of the hysteresis of SIP. Repeated missions 
will require SIP that is less susceptible to 
dimension changes with steady and vibratory loads. 

5. Reassessment of flight controls concepts. It is 
suggested that multiple control surfaces or drives 
be considered. 

6. Investigate non-hypergolic fuel and oxidizer for 
orbital boost, on orbit control motors, and APUs. 

D. For the remaining R&D flights, it is suggested that a 
"redline” audit be made of limits that should not be exceeded 
for "ready to launch." It is poor practice to set 
conservative limits and then bypass them at last minute 
launch readiness conferences. 

For 1982 the ASAP plans to follow the developing 
operational transportation program to review hardware 
changes, procedural changes, and the progress in clarifying 
the duties and responsibilities of any new operational 
organization. The review of 1982 scheduled flights, their 
readiness and performance, will be a primary ASAP activity. 
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In additiont th« ASAP plans to ravislt non<>8huttla flight 
aetivitias at NASA eantara both support and tatt. Pinally« 
in 1982 tha ASAP plans to raviaw coneapts and hardwara for 
Shuttla payloads and uppar stagas sinca aany of tha uniqua 
mission aquipmant itans introduca potantial oparatienal 
hasards to both individual craw mambars and tha Shuttla 
itsalf. 
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